# Night Tsunami

> As of 2026-10-19, Night Tsunami is a Serbia-nexus threat actor tracked by Threadlinqs Intelligence across 4 threats spanning malware, threat intel. Also known as NSO Group tooling. ATT&CK coverage spans 33 techniques across 12 tactics in 4 of 4 tracked threats. Most-observed techniques: T1660 (Phishing), T1664 (Exploitation for Initial Access), T1409 (Stored Application Data).

- **Nation:** Serbia
- **Tracked threats:** 4
- **Categories:** MALWARE, THREAT_INTEL
- **Also known as:** NSO Group tooling
- **As of:** 2026-10-19

## ATT&CK techniques observed

33 techniques observed across 4 of 4 tracked threats. Tactics: Collection (Mobile) (11), Discovery (Mobile) (6), Initial Access (Mobile) (4), Resource Development (3), Persistence (Mobile) (2), Command and Control (1).

- [T1660](https://intel.threadlinqs.com/technique/T1660) Phishing — Initial Access (Mobile) — observed in 3 of 4 tracked threats
- [T1664](https://intel.threadlinqs.com/technique/T1664) Exploitation for Initial Access — Initial Access (Mobile) — observed in 3 of 4 tracked threats
- [T1409](https://intel.threadlinqs.com/technique/T1409) Stored Application Data — Collection (Mobile) — observed in 2 of 4 tracked threats
- [T1429](https://intel.threadlinqs.com/technique/T1429) Audio Capture — Collection (Mobile) — observed in 2 of 4 tracked threats
- [T1512](https://intel.threadlinqs.com/technique/T1512) Video Capture — Collection (Mobile) — observed in 2 of 4 tracked threats
- [T1636](https://intel.threadlinqs.com/technique/T1636) Protected User Data — Collection (Mobile) — observed in 2 of 4 tracked threats
- [T1646](https://intel.threadlinqs.com/technique/T1646) Exfiltration Over C2 Channel — Exfiltration (Mobile) — observed in 2 of 4 tracked threats
- [T1658](https://intel.threadlinqs.com/technique/T1658) Exploitation for Client Execution — Execution (Mobile) — observed in 2 of 4 tracked threats
- [T1090.003](https://intel.threadlinqs.com/technique/T1090.003) Multi-hop Proxy — Command and Control — observed in 1 of 4 tracked threats
- [T1204.001](https://intel.threadlinqs.com/technique/T1204.001) Malicious Link — Execution — observed in 1 of 4 tracked threats
- [T1404](https://intel.threadlinqs.com/technique/T1404) Exploitation for Privilege Escalation — Privilege Escalation (Mobile) — observed in 1 of 4 tracked threats
- [T1418](https://intel.threadlinqs.com/technique/T1418) Software Discovery — Discovery (Mobile) — observed in 1 of 4 tracked threats
- [T1421](https://attack.mitre.org/techniques/T1421/) System Network Connections Discovery — Discovery (Mobile) — observed in 1 of 4 tracked threats
- [T1422](https://intel.threadlinqs.com/technique/T1422) System Network Configuration Discovery — Discovery (Mobile) — observed in 1 of 4 tracked threats
- [T1422.001](https://attack.mitre.org/techniques/T1422/001/) Internet Connection Discovery — Discovery (Mobile) — observed in 1 of 4 tracked threats

## Tracked threats

- [WhatsApp contempt bid against NSO Group denied: alleged post-injunction spearphishing of WhatsApp users (Pegasus)](https://intel.threadlinqs.com/threat/TL-2026-3914) — MEDIUM
- [Pegasus (NSO Group) zero-click iMessage spyware and NoviSpy used against Serbian student-movement, opposition and civil-society targets ahead of October 2026 elections](https://intel.threadlinqs.com/threat/TL-2026-3873) — HIGH
- [NSO Group Pegasus: Vendor Retained Exclusive Control of Infection Server Module and Technical Access to Data Harvested in Polish Government Operations](https://intel.threadlinqs.com/threat/TL-2026-3527) — HIGH
- [NSO Group Co-Founder Shalev Hulio Held Israeli Diplomatic Passport in Panama, Raising State-Ties Questions for Pegasus Spyware Vendor](https://intel.threadlinqs.com/threat/TL-2026-1748) — INFORMATIONAL

## Related CVEs

4 CVEs referenced by tracked Night Tsunami activity.

- [CVE-2021-30860](https://intel.threadlinqs.com/cve/CVE-2021-30860)
- [CVE-2016-4657](https://intel.threadlinqs.com/cve/CVE-2016-4657)
- [CVE-2016-4656](https://intel.threadlinqs.com/cve/CVE-2016-4656)
- [CVE-2016-4655](https://intel.threadlinqs.com/cve/CVE-2016-4655)

## Full data

Infrastructure, IOC values and detection queries (Splunk SPL / Microsoft KQL / Sigma) require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/actor/Night%20Tsunami